Security research, threat intelligence insights, and product updates.
We observed a Redis exploitation bot in its natural habitat: an unprotected instance on port 6379. What followed was a textbook cron injection, captured in full by our honeypot network. INFO recon, 6.5 seconds of stillness, then 25 commands in 11 seconds. A parasitoid wasp in digital form.
Our honeypot sensors emulate exposed Docker daemons and record everything attackers do. We pulled a 24-hour snapshot: 3,964 events from 144 IPs, container escapes via nsenter, SSH key backdoors locked with chattr, a self-replicating worm from 100 IPs, and cron persistence — all before anyone touched the application layer.
Our Doha honeypot captured a massive SMTP phishing operation overnight. 3,664 events, 378K+ targeted email addresses, and a Powerball lottery scam impersonating a real lottery winner. Here's the full breakdown.
A new bot is actively identifying Cowrie, Kippo, Dionaea, Glastopf, OpenCanary, and Honeytrap installations before deciding whether to attack. We captured the full session. Nobody else is talking about this.